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This application was preliminarily rejected pursuant to Article 63 of the 
Korean Patent Law based on the following reason. Should there be any 
opinion against this action, please file a written argument by October 30, 2005. 
(You can apply for 1 -month extension per each case, and we do not notify you 
of the confirmation for such term extension.) 

[REASON] 

This invention is the same as the invention described in a specification or a 
drawing first attached to an application of Korean Patent Publication No. 
2004-063494 (reference 1), which is filed in 2003 before the filing date of the 



invention. The inventors of the present invention are different from the 
inventors of the reference 1, and the applicant of the present invention is 
different from the applicant of the reference 1. Accordingly, the above- 
identified patent application cannot be registered pursuant to Article 29, 
Paragraph 5 of the Korean Patent Law. 

[BELOW] 

The present invention is directed to a method for detecting abnormal traffic at 
a network level using statistical analysis, and more particularly, to a method 
for detecting abnormal traffic within short time by extracting characteristic 
traffic data by integrating traffic data collected from each device on a network 
into entire traffic data at network level, and comparing the extracted traffic 
data with a characteristic traffic data profile, which is a normal Multiple 
Intelligence (MI) statistical model, and a recording medium thereof. 

Meanwhile, Korean Patent Publication No. 2004-063494 (reference 1), 
published on July 14, 2004, and filed on January 8, 2003, which relates to an 
apparatus for examining stability of a circuit using an Internet traffic 
characteristic, discloses an apparatus for examining the stability and condition 
of a network in real-time by producing and using a critical value required for 
determination of the stability by collecting traffic data, and method thereof. 
Therefore, it is concluded that the present invention is substantially the same 
as the reference 1 in the structure and effect except that the present invention 
suggests concretely limited statistics which become a comparison basis for 
abnormal traffic detection. 
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value required for determining the stability. 1 

CONSTITUTION: A traffic data collecting unit(120) collects traffic datai 
from a network equipment(1 1 0). An automatic threshold value, 
calculating unit(130) automatically calculates a threshold value as aj 
reference value for determining stability of a line with the collected: 
traffic data. An Interface characteristics data collecting unit(1 40) i 
collects interface characteristics data from the network equipment; 

(110). A stability determining unit(150) determines stability of a corresponding line with the collected traffic data and the 
interface characteristics data. A traffic data DB(125) stores traffic data collected by the traffic data collecting unit(120). A 
threshold value DB(135) stores a threshold value calculated by the automatic threshold value calculating unit(130). An 
interface characteristics data DB(145) stores the interface characteristics data collected by the interface characteristics data 
collecting unit(140). 
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(57) Abstract: 



PURPOSE: An apparatus and method for diagnosing stability of a line : 
by using an Internet traffic characteristics are provided to determine 
stability by collecting traffic data of a line and calculating a threshold : 
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